app

type App struct {
	// contains filtered or unexported fields
}

type BackgroundJob func(JobContext)

type InviteInfo = web.InviteInfo

type JobContext struct {
	Ctx  context.Context
	Pool *pgxpool.Pool
	Log  *slog.Logger
}

type LimitProvider = guardrail.LimitProvider

type LimitProviderFactory func(base LimitProvider, pool *pgxpool.Pool) LimitProvider

type Limits = guardrail.Limits

type LoginInterceptor = auth.LoginInterceptor

type LoginInterceptorFactory func(pool *pgxpool.Pool) LoginInterceptor

type MemberAdmin = web.MemberAdmin

type MemberAdminFactory func(pool *pgxpool.Pool) MemberAdmin

type MemberInfo = web.MemberInfo

type Option func(*options)

type PostAuthContext = auth.PostAuthContext

type RouteContext struct {
	Mux  *http.ServeMux
	Pool *pgxpool.Pool
	Log  *slog.Logger
	// Gate wraps a handler in the dashboard auth middleware (session-cookie
	// verification, redirect/401 on failure) so an extension can mount its own
	// authenticated routes with the same gate the dashboard uses. It is nil when
	// auth is off (no control plane) — a registrar that needs auth must check and
	// mount nothing.
	Gate func(http.Handler) http.Handler
	// SessionOrg reads the caller's verified org id from a request that has passed
	// through Gate. It is the ONLY sanctioned way for an extension to learn the
	// caller's org (never the request body), keeping the session context key
	// private to auth. Nil when auth is off.
	SessionOrg func(*http.Request) (orgID string, ok bool)
	// SessionMemberID reads the caller's verified member id from a request that has
	// passed through Gate. Like SessionOrg it reads the private auth session context
	// key an extension cannot reach directly, so an extension can resolve the caller's
	// own member row (e.g. their email) without trusting request input. Nil when auth
	// is off.
	SessionMemberID func(*http.Request) (memberID string, ok bool)
	// RenderShell writes a full dashboard page (sidebar + top bar chrome) wrapping
	// the given content, so an extension's own page looks native to the dashboard
	// instead of a detached page. content is trusted HTML the caller produced from a
	// template; title sets the top-bar heading and browser tab. Always non-nil.
	RenderShell func(w http.ResponseWriter, r *http.Request, title string, content template.HTML)
	// RenderDoc writes a full public documentation page (the /doc dark shell with the
	// shared table of contents in the left rail) wrapping the given body, so an
	// extension's own doc page is indistinguishable from a core one. body is trusted
	// HTML — a composing build produces it from its embedded Markdown via
	// docs.MarkdownToHTML. Unlike RenderShell the page is public (no auth chrome), so
	// this is the seam for extension /doc/* pages. Always non-nil.
	RenderDoc func(w http.ResponseWriter, r *http.Request, title string, body template.HTML)
	// Usage returns the operator-facing volumetry for one tenant (liveness,
	// cardinality, 30-day requests, estimated disk) so an operator console can render
	// a per-account usage page without importing the internal storage layer. It is a
	// cross-tenant capability guarded by the composing build's own operator check —
	// the seam does no authorization. Always non-nil (ClickHouse is the data plane).
	Usage func(ctx context.Context, tenantID string) (UsageStats, error)
	// LastIngestByTenant returns the most recent ingest time per tenant in one scan,
	// so an operator account list can flag live vs churned accounts without an N+1.
	// Like Usage it is unauthorized here and gated by the composing build. Always
	// non-nil.
	LastIngestByTenant func(ctx context.Context) (map[string]time.Time, error)
}

type RouteRegistrar func(RouteContext)

type UsageStats struct {
	FirstIngest time.Time
	LastIngest  time.Time
	Endpoints   uint64
	Series      uint64
	Services    uint64
	Instances   uint64
	Requests30d uint64
	DiskBytes   uint64
}